Skip to content

Update "Incident Tasks" availability in Defender portal#128125

Open
arunscloud wants to merge 1 commit intoMicrosoftDocs:mainfrom
arunscloud:patch-1
Open

Update "Incident Tasks" availability in Defender portal#128125
arunscloud wants to merge 1 commit intoMicrosoftDocs:mainfrom
arunscloud:patch-1

Conversation

@arunscloud
Copy link

Incidents Tasks are available in the Defender portal, however, our documentation indicates that tasks aren't available.

Incidents Tasks are available in the Defender portal, however, our documentation indicates that tasks aren't available.
@prmerger-automator
Copy link
Contributor

@arunscloud : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change.

@learn-build-service-prod
Copy link
Contributor

Learn Build status updates of commit 9392720:

⚠️ Validation status: warnings

File Status Preview URL Details
articles/sentinel/move-to-defender.md ⚠️Warning Details

articles/sentinel/move-to-defender.md

  • Line 230, Column 102: [Warning: file-not-found - See documentation] Invalid file link: 'defender-xdr/split-incidents-into-tasks.md'.
  • Line 168, Column 144: [Suggestion: preserve-view-not-set - See documentation] You've pinned this link to a specific version of content with the view parameter. It's recommended not to pin a version unless that version is A) not the default view and B) the context is about that version specifically. To proceed with pinning a version add the &preserve-view=true to the URL. Otherwise, remove the view parameter. URL: /graph/api/resources/security-api-overview?view=graph-rest-1.0

For more details, please refer to the build report.

Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.

@v-regandowner v-regandowner requested a review from Copilot January 21, 2026 16:16
@v-regandowner
Copy link
Contributor

@guywi-ms

Can you review the proposed changes?

IMPORTANT: When the changes are ready for publication, adding a #sign-off comment is the best way to signal that the PR is ready for the review team to merge.

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

@prmerger-automator prmerger-automator bot added the aq-pr-triaged tracking label for the PR review team label Jan 21, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates documentation to reflect that Incident Tasks are now available in the Microsoft Defender portal, correcting previously outdated information that indicated they were unavailable.

Changes:

  • Updated the incident tasks availability status from "unavailable" to "available" in the Defender portal
  • Updated the reference link to point to new Defender XDR documentation about tasks

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

|**Programmatic and manual creation of incidents** | Incidents created in Microsoft Sentinel through the API, by a Logic App playbook, or manually from the Azure portal, aren't synchronized to the Defender portal. These incidents are still supported in the Azure portal and the API. See [Create your own incidents manually in Microsoft Sentinel](create-incident-manually.md). |
| **Reopening closed incidents** | In the Defender portal, you can't set alert grouping in Microsoft Sentinel analytics rules to reopen closed incidents if new alerts are added. <br>Closed incidents aren't reopened in this case, and new alerts trigger new incidents.|
| **Tasks** | Incident tasks are unavailable in the Defender portal. <br><br>For more information, see [Use tasks to manage incidents in Microsoft Sentinel](incident-tasks.md). |
| **Tasks** | Incident tasks are available in the Defender portal. <br><br>For more information, see [Streamline incident response using tasks in the Microsoft Defender portal](defender-xdr/split-incidents-into-tasks.md). |
Copy link

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The link path appears to be a relative path starting with 'defender-xdr/', but this may be incorrect depending on the documentation structure. Verify that this relative path correctly resolves from the current file location (articles/sentinel/). If the target document is in a 'defender-xdr' folder at the root level, the path should likely be '/defender-xdr/split-incidents-into-tasks.md' or '../defender-xdr/split-incidents-into-tasks.md'.

Suggested change
| **Tasks** | Incident tasks are available in the Defender portal. <br><br>For more information, see [Streamline incident response using tasks in the Microsoft Defender portal](defender-xdr/split-incidents-into-tasks.md). |
| **Tasks** | Incident tasks are available in the Defender portal. <br><br>For more information, see [Streamline incident response using tasks in the Microsoft Defender portal](/defender-xdr/split-incidents-into-tasks.md). |

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants